Executive brief
CentreStack, a file-sharing and remote access platform used by managed service providers, contains a security vulnerability that allows authorized users to gain full control over the server. By sending specially crafted requests to the system's API, an attacker can bypass security controls to run unauthorized database commands. This can lead to the theft of sensitive client data, the ability to plant malicious files on the server, and complete system takeover, potentially impacting all organizations managed through the platform.
Technical details
A SQL injection vulnerability exists in CentreStack versions prior to 17.4 within the GladDBFiles.SearchEx() and SearchExUnder() functions. The flaw is rooted in the unsanitized interpolation of the 'Field' parameter from the 'x-glad-filter' request header into SQL query strings via the jsondir API endpoint. An authenticated attacker can exploit this to execute arbitrary SQL commands. In environments using PostgreSQL, this can be further escalated to remote code execution (RCE) by utilizing the lo_from_bytea() and lo_export() functions to write malicious files directly to the server's filesystem. Users should upgrade to CentreStack version 17.4 or later to remediate this vulnerability.
Affected products
- Gladinet CentreStack before 17.4
Timeline
- 2026-07-30: advisory: NVD and VulnCheck published the advisory.